1berry/haproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BUG/MAJOR: hpack: fix length check for short names encoding

Browse Source 
Commit 19ed92b ("MINOR: hpack: optimize header encoding for short names")
introduced an error in the space computation for short names, as it removed
the length encoding from the count without replacing with 1 (the minimum
byte). This results in the last byte of the area being occasionally
overwritten, which is immediately detected with -DDEBUG_MEMORY_POOLS as
the canary at the end gets overwritten.

No backport is needed.
This commit is contained in:
Willy Tarreau 2018-12-16 09:38:30 +01:00
parent 7a0139e2b6
commit 0dc1b84839
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/hpack-enc.c
View File

@ -177,7 +177,7 @@ int hpack_encode_header(struct buffer *out, const struct ist n,
} }
make_literal: make_literal:
if (likely(n.len < 127 && len + 1 + n.len <= size)) { if (likely(n.len < 127 && len + 2 + n.len <= size)) {
out->area[len++] = 0x00; /* literal without indexing -- new name */ out->area[len++] = 0x00; /* literal without indexing -- new name */
out->area[len++] = n.len; /* single-byte length encoding */ out->area[len++] = n.len; /* single-byte length encoding */
ist2bin(out->area + len, n); ist2bin(out->area + len, n);